AI features inside products
AI built into ordinary apps as buttons and features, where the app's own server calls a model API behind the scenes.
Read first: Retrieval-augmented generation (RAG).
D1 · StoryFor young children and total beginners
Lots of apps now have an AI button: summarise this, tidy my writing, find similar photos.
There may be no chat box at all. When you press the button, the app quietly asks a model and shows you the answer.
What happens when you press the AI button
- You: press the button
- The app: on your phone
- The app's computer: far away
- The model: writes the answer
Like: A café that buys its bread from a bakery: you only see the plate.
D2 · PictureFor curious beginners
The usual pattern: the app's server builds a prompt from a template plus your data (often found with retrieval), calls a model over an HTTP API, and gets text or structured JSON back to show in the interface.
The API key stays on the server, never in the web page or phone app. Many products route calls through a gateway that can switch models and providers, using a small, cheap model for simple jobs and a larger one for hard ones.
Model output is treated as untrusted input: it is checked before it is shown, stored or used to trigger actions, and usage is logged and limited to control cost.
Like: A café that buys its bread from a bakery.
Where it breaks: A bakery makes the same loaf every day. A model can return a different or wrong answer, or one steered by text hidden in your document, so the app must check what comes back.
D5 · FrontierFor experts
Adding a model to a product is easy to demo. Keeping it correct, safe and affordable once real users and real data flow through it is harder.
Injection through content. Anything users or third parties put into a prompt can carry instructions; OWASP lists prompt injection first among risks for LLM apps (OWASP LLM01).
You own what it says. A tribunal held an airline responsible for wrong fare advice from its website chatbot, rejecting the argument that the bot was a separate entity (Moffatt v. Air Canada, 2024).
Checking quality at scale. People's grading criteria shift as they see outputs ("criteria drift"), so automatic graders need regular checking against people (Shankar et al., 2024).
Output into other systems. Passing model output straight into a browser, database or shell opens the door to classic attacks (OWASP LLM05).
Examples as of 2026-10-30
- Apple Intelligence
- Gemini features in Gmail and Google Docs
- Notion AI
- Photo editing tools such as Adobe Firefly in Photoshop
Sources
- Building effective agents (Anthropic) (2024-12-19)
- OWASP Top 10 for LLM Applications 2025 (2025)
- Using the Messages API (Claude API documentation) (2026)
- OWASP Top 10 for LLM Applications: LLM01:2025 Prompt Injection (2025)
- Moffatt v. Air Canada, 2024 BCCRT 149 (Civil Resolution Tribunal of British Columbia) (2024-02-14)
- Who Validates the Validators? Aligning LLM-Assisted Evaluation of LLM Outputs with Human Preferences (2024-04-18)
- OWASP Top 10 for LLM Applications: LLM05:2025 Improper Output Handling (2025)
How it connects
- AI features inside products grows into Copilots.
- Retrieval-augmented generation (RAG) supplies your data to AI features inside products.
More in Layer 9 · Applications & Interfaces
- Chat assistants
General-purpose chat apps where you type, talk or upload files, and an assistant answers, writes, searches and uses tools. - Voice & multimodal interfaces
Talking to AI out loud and showing it images or video, through phones, cars, speakers and glasses. - Copilots
AI built into the tools people already work in, such as code editors, documents and email, suggesting and increasingly acting while the person stays in charge.